Windows Failover Cluster EUVD-2026-100268

Exploitation requires the target host to have the Windows Failover Clustering role/feature configured and its cluster communication service reachable over the network by the attacker; hosts without clustering enabled are not affected. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed, so any party with network access to the cluster service can trigger it. The primary limiting factor is deployment scope: cluster inter-node traffic is typically confined to internal management/heartbeat networks, so realistic exposure depends on whether that network is reachable by untrusted parties. Affected builds are Windows Server 2019 (<10.0.17763.9376), Server 2022 (<10.0.20348.5761), and Server 2025 (<10.0.26100.33650), including Server Core installations.

The CVSS 3.1 base score of 7.5 (HIGH) is driven entirely by availability impact (A:H) via a network vector requiring no privileges or user interaction (AV:N/AC:L/PR:N/UI:N), with no confidentiality or integrity impact (C:N/I:N) - consistent with CWE-248 (Uncaught Exception) producing a denial of service. This is a genuine DoS risk against clustered Windows Server deployments, not an RCE. However, the real-world priority signals are weaker than the headline score suggests: no EPSS exploitation-probability score was provided, the CVE is NOT in CISA KEV, and no public POC is identified - so exploitation status is currently theoretical. The vulnerability was reported internally by Microsoft (secure@microsoft.com), which typically indicates vendor-discovered rather than in-the-wild-observed issues, further suggesting no active exploitation at this time. One conflicting signal must be flagged: the input Tag 'Authentication Bypass' directly contradicts both the description (a DoS via uncaught exception) and the CVSS vector (C:N/I:N means no data or system is compromised) - this tag appears mislabeled and should not factor into risk scoring. Net assessment: a legitimate HIGH-severity availability threat to Failover Cluster nodes, worth prioritized patching on clustered hosts, but currently lacking the EPSS/KEV/POC corroboration that would elevate it to emergency status.

An attacker with network reachability to a Windows Server running the Failover Clustering role sends a crafted or malformed message to the cluster service. The service fails to handle an exception condition (CWE-248), causing the cluster service process to terminate and disrupting cluster availability and any hosted highly-available workloads. No public exploit code has been identified, so this scenario is inferred from the CVSS network/unauthenticated vector and the uncaught-exception weakness.